Authentication Failed events

[billfreitas]

Hello all

I am having an issue with an authentication from the Attendant Console to CM. The attendant console is working fine. All ports are registered and all test from within the Attendant console pass/show as working.

However in RTMT I am seeing the following error every 1-3 minutes. 

Number of AuthenticationFailed events exceeds configured threshold during configured interval of time 1 within 3 minutes  on cluster StandAloneCluster.  There are 2 AuthenticationFailed events (up to 30) received during the monitoring interval From Wed Aug 20 13:08:41 PDT 2014 to Wed Aug 20 13:11:41 PDT 2014:   TimeStamp : 08/20/2014 at 13:09:34 LoginFrom : 10.10.1.25 Interface : Apache-Axis2 UserID : CUEACSysUser AppID : Cisco Tomcat ClusterID :  NodeID : sacpcmpub  TimeStamp : Wed Aug 20 13:09:34 PDT 2014  TimeStamp : 08/20/2014 at 13:08:44 LoginFrom : 10.10.1.25 Interface : Apache-Axis2 UserID : CUEACSysUser AppID : Cisco Tomcat ClusterID :  NodeID : sacpcmpub  TimeStamp : Wed Aug 20 13:08:44 PDT 2014 

10.10.1.25 is the Attendant console Server - Version - 8.6.2.11

Call Manager Version is 8.6.2.24089-2

"CUEACSysUser" is the username in the Cisco CTI on the Attendant Console that is working correctly

I am at a lost as to what is trying to log in from that server via AXL

[Jonathan Schulenberg]

Confirm that the CUCM Application User isn't locked out and that the password is set to never expire. Also verify that it has all the permissions that it's supposed to have. It needs a group with the following roles:

Standard AXL API Access
Standard CTI Allow Calling Number Modification
Standard CTI Allow Control of All Devices
Standard CTI Allow Control of Phones supporting Connected Xfer and conf
Standard CTI Allow Control of Phones supporting Rollover Mode
Standard CTI Allow Reception of SRTP Key Material
Standard CTI Enabled

http://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/cucmac/arc/CUACEE_V901_WA_.pdf